The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local helper binary (cmux-cua) to execute system-level actions like clicking, typing, and capturing screenshots. The execution path is restricted to a vendor-controlled location, and the skill includes scripts (client-policy.sh) to verify the binary's ownership and permissions before use.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the macOS accessibility tree and screen content, which could contain adversarial instructions.
Ingestion points: The get_app_state and get_window_state tools retrieve screenshots and UI hierarchy data.
Boundary markers: The skill relies on the standard Model Context Protocol (MCP) structure; however, it lacks specific delimiters for screen-scraped text.
Capability inventory: The skill has extensive capabilities, including mouse and keyboard simulation across the operating system.
Sanitization: No sanitization of the scraped UI text is performed, but the skill instructions mandate explicit user consent for every session to mitigate unauthorized actions.
[PERSISTENCE]: The skill manages its own lifecycle by creating symlinks in standard agent skill directories (e.g., ~/.agents/skills). These operations are strictly validated to ensure they only point to legitimate application bundles owned by the current user or root.

cmux-cua